Finding opportunities in the new regulatory challenge

The viability statement Finding opportunities in the new regulatory challenge March 2015

Foreword

The clock is already ticking for directors of listed1 companies with accounting periods beginning on or after 1 October 2014 who will need to make their first viability statement — a new requirement of the 2014 UK Corporate Governance Code (the ‘2014 Code’) — in their 2015 annual report and accounts (ARAs). The processes required to support the viability statement will need to be established rapidly and operate on an ongoing basis throughout the year, rather than solely at year end. We have compared and contrasted in Appendix 1 current practices and processes with what we think will be necessary to comply with the 2014 Code. Management teams and company boards are therefore advised to take action well before their year-end approaches. Above all, the two most vital questions that they need to be able to answer with rigour are:

Contents 1. T he viability statement: a practical perspective

2

2. Risk management implications

5

3. Analysis and evidence

7

4. Conclusion and contacts

10

5. Appendix 1

11

►► What period will our viability assessment cover? ►► What assurance will we need to make the statement with confidence? Early action isn’t only needed to ensure such questions can be answered appropriately and all compliance obligations met. Developing a thoughtful response to the 2014 Code’s new viability requirements could bring opportunities including a better understanding of risk appetite, enhanced business resilience, a lower cost of capital, and hence the potential for improved financial performance. EY research2 has found that companies with more mature risk management practices generate three times the level of EBITDA as those with the least mature risk management practices. This research also found that financial performance is highly correlated with the level of integration and coordination across risk, control and compliance functions — emphasising that greater departmental coordination around risk activities can deliver benefits beyond pure compliance. Leading companies have also been found to embed risk management into business planning and performance management — an approach also recommended to help boards meet the viability statement challenge. There is evidence that those who view the viability statement as more than a compliance exercise are likely to gain the most benefit.

remium listed entities (incorporated in the UK or overseas) and other P listed entities that seek to voluntarily comply with the UK Corporate Governance Code. 2 Turning risk into results: How leading companies use risk management to fuel better performance 1

EY research2 has found that companies with more mature risk management practices generate three times the level of EBITDA as those with the least mature risk management practices.

Steps to take now ►► Organise a board briefing session to establish a common understanding of the 2014 Code provisions, in particular: ►► The viability statement and how it differs from existing going concern requirements. ►► Risk management and internal controls, including the emphasis on ongoing monitoring, assessing principal risks using a solvency and liquidity lens, and the new associated reporting requirements. ►► Schedule management and boardroom time to agree upon and establish the process needed to support the board’s new viability statement — this may be more than you initially think. ►► Plan how to coordinate inter-departmental working, e.g., between risk, internal audit, treasury, planning, finance etc. Decide who will take overall responsibility for coordinating the process and consider appointing a project manager. ►► Consider actions needed for the board to reach a consensus on risk appetite and on the period to be covered, including the preparation of appropriate documentation. ►► Determine the scope and nature of qualitative and quantitative analysis required e.g., types of stress testing and scenario analysis. ►► Assess your capabilities and resource needs to conduct stress testing, scenario planning, the quantification of principal risks, and the evaluation of risk mitigation actions. ►► Involve your auditors early on — provide them with an outline of your methodology and approach to implementing the 2014 Code changes. ►► Assess how to embed process changes needed to support the viability statement into the business planning cycle. ►► Consider conducting a ‘dry run’ of your viability process to help identify any gaps in information flows needed to support your disclosures on viability and internal control effectiveness. This could be done as part of the half year reporting process.

The viability statement Finding opportunities in the new regulatory challenge — March 2015

1

1

The viability statement: a practical perspective

In September 2014, we published a regulatory update, Looking to the future, which provided a summary of the 2014 Code changes and set out some questions directors should start to consider in respect of the changes. Since then we have been talking to companies specifically about the changes to risk management and viability. We also held a webinar3 on 2 February 2015 during which we polled participants on what they saw as the main challenges and the changes that would be required. This paper summarises key findings and provides our views on some of the issues boards and management will need to consider. We also suggest actions that companies should take to ensure they are able to meet the new viability statement requirement in their 2015 ARAs. Whilst there are some common steps that all companies should take, the conclusions they reach (on the period to cover, for example) will be company specific.

What does the viability statement involve? Under the 2014 Code, (new Provision C.2.2) directors are required to make a new viability statement in the ARA. The directors should: ►► Taking account of the company’s current position and principal risks, explain how they have assessed the prospects of the company, over what periods they have done so and why they consider that period to be appropriate. ►► State whether they have a reasonable expectation that the company will be able to continue in operation and meet its liabilities as they fall due over the period of their assessment, drawing attention to any qualifications or assumptions as necessary. Important points to note are that the viability statement is: ►► Separate and additional to the board’s current going concern statement ►► Underpinned by the board’s responsibility for risk and ongoing risk monitoring

3

The new viability statement — A natural evolution or hostage to fortune? https://registration.livegroup.co.uk/eycorporategovernancecode/ContentTabs/?ctid=267


2

1


Given what you’ve heard today, where do you think your company will face the greatest difficulty? Please select the top 2 issues.

Initial market reactions From our discussions with boards and management of FTSE 350 companies, we have learned the following: ►► There is little interest in early adoption i.e., publicly making a viability statement before it becomes a requirement. Some companies intend to conduct a ‘dry run’ to help identify any gaps in information flows required to support the viability statement. ►► The biggest impact on processes is expected among companies outside the financial services sector, particularly in relation to stress testing, scenario analysis and the quantification of risk. ►► Few companies are thinking about principal risks to viability — i.e., risks that could ‘kill’ the company, as opposed to risks to strategy that are more traditionally disclosed in the ARA. ►► Management teams are finding it hard to engage boards on the topic and have asked how they can secure appropriate, timely boardroom attention.

22% Managing the process to support the Board’s viability statement

Potential challenges for the board Preparing a viability statement presents a number of challenges for boards, such as:

19% Assessing risk appetite

►► Determining the appropriate period to cover, which is a company specific matter

16% Stress testing (including reverse stress testing)

►► Determining what evidence the board will need to support its statement in the ARA

15% Quantification of risks

►► Ensuring sufficient time is allowed to enable the board to reach a consensus on issues such as risk appetite

14% Building a fit-for-purpose financial model

►► Understanding how to link the company’s existing risk assessment process into the process to support the viability statement

9% Assessing internal control effectiveness

►► Ensuring that the viability statement includes an assessment of the principal risks associated with the implementation of the business strategy/plan

5% Communications with stakeholders

►► Determining how much extra quantification work will be needed to assess the potential impact of principal risks on the company’s financial position and liquidity ►► Ensuring that the management team allocates sufficient senior resources with the necessary knowledge, skills and competencies to prepare the detailed viability assessment required to support the board’s statement ►► Embedding the viability statement process into the annual planning and reporting cycle


3

1


The scope of the challenge was revealed in our February 2015 webinar. When asked to identify where their company would face the greatest difficulty, participants highlighted a range of areas. Managing the process to support the board’s viability statement topped the list, just ahead of the challenge of assessing risk appetite.

Updated or new processes

77% of participants said they would need to develop a specific process to support the board’s viability statement.

For most companies new processes will be required to support the board in making their viability statement or existing processes will need to be revised. Having listened to our speaker panel on the February 2015 webinar, 77% of participants said they would need to develop a specific process to support the board’s viability statement. Another 8% said that the new requirement represents a ‘fundamental change’ in how they assess and report on business viability.

How significant a challenge does the new viability statement present for your company?

77% We will need to develop a specific process to support the Board’s viability statement which will require some management time 10% It is just an update to the existing going concern assessment, so not a significant change 8% It represents a fundamental change in how we assess and report on business viability 5% I’m not sure, and will need further guidance


4

2

Risk management implications

Which of the following aspects of a risk management process (that is necessary to underpin the viability statement) represents the biggest change for your company?

The 2014 Code requires that, in the ARA, the directors should: ►► Confirm they have carried out a robust assessment of the principal risks facing the company, including those that would threaten its business model, future performance, solvency or liquidity (new Provision C.2.1) ►► Describe the principal risks and explain how they are being managed or mitigated (new Provision C.2.1) Under the 2014 Code, the board should also: ►► Monitor the company’s risk management and internal control systems on an ongoing basis (revised Provision C.2.1, now Provision C.2.3) ►► At least annually, carry out a review of their effectiveness, and report on that review in the ARA (revised Provision C.2.1 now Provision C.2.3) ►► Explain in that report what actions have been or are being taken to remedy any ‘significant failings or weaknesses’ identified

37% Defining risk appetite with appropriate documentation that supports a common understanding 26% Quantifying financial and cash flow impact of principal risks 25% Undertaking and/ or reporting on the effectiveness of risk management and internal control

The emphasis on ‘ongoing’ monitoring in the 2014 Code is new, as is the requirement for the inclusion in the ARA of the board’s report on the review of the effectiveness of risk management and internal control systems. The result is that a greater level of assurance will generally be required than in the past.

Widespread impact It is likely that a number of aspects of risk management processes, required to underpin the viability statement, will need to change. Participants in our February 2015 webinar were asked what they thought would be the biggest change for them. The largest group (37%) identified defining risk appetite as being the most significant area that their organisation would need to address. Many participants identified other changes too — as shown in the graphic alongside.

12% Assessing and evaluating principal risks using a liquidity and solvency lens


5

2

Risk management implications

Risk arrangements and processes will need to be enhanced Based on our conversations with companies, we have identified three areas likely to require greater attention by companies: ►► Risk appetite The Financial Reporting Council (FRC) considers risk appetite as key to the whole viability statement process (highlighting it as one of the board’s key responsibilities)4. From our interactions with companies, whilst many can define risk appetite conceptually and can generally agree on those risks that are acceptable and those that are not, they do not have an agreed risk appetite statement with clear parameters relating directly to the business model. Reaching consensus on risk appetite will require preparation, board engagement and a structured process with practical examples based on assessing the acceptability of different risk outcomes that might be tolerated in order to achieve certain business objectives, both now and in the future. ►► Risk quantification Traditional UK risk management processes have not tended to quantify risks in financial terms. The 2014 Code specifically links principal risks and their potential impact on viability, particularly in the context of solvency and liquidity. Therefore, companies will now have to consider the P&L or cash flow impact of a risk if it believes that those risks could impact on viability over the period of the assessment. This will also require an assessment of the velocity of risk — the speed with which the impact of a risk will be felt — particularly when considering liquidity. In addition, boards will need to consider risk combinations, not just the impact of individual risks in isolation. This will require greater inter-departmental working, for example, between risk and treasury teams. ►► Effectiveness assessments In aiming to meet both the viability statement and the expanded requirements around board responsibility for risk management and internal control systems, companies need to consider whether their current control assessment activities over principal risks are fit for purpose. This is crucial to the credibility of the viability statement and board comfort in making the statement. Many organisations currently base their risk management and internal control effectiveness assessments on an annual review of internal audit activity and self-assessment processes. It may be that these need to be enhanced.

4

Para 24 of the Guidance on Risk Management, Internal Control and Related Financial and Business Reporting (the Guidance)


6

3

Analysis and evidence

The Guidance explains that the viability statement should be based on a robust assessment of the principal risks that would threaten the company’s business model, future performance, solvency or liquidity. The assessment should include: ►► Resilience to threats to the company’s viability in severe but plausible scenarios ►► Sufficient qualitative and quantitative analysis which should be as thorough as judged necessary to make a sound statement ►► Stress testing (including reverse stress testing) and sensitivity analysis — as the Guidance states, this will often assist the directors in making their statement ►► Broad consideration of the relevant matters that may threaten viability As the Guidance clarifies, ‘reasonable expectation’ of the company’s viability does not mean ‘certainty’, but does mean the assessment is rigorous and can be justified. Board judgement is required, but the longer the period considered, the greater the degree of uncertainty expected.

Qualitative and quantitative analysis The board’s qualitative and quantitative analysis will be based on the company’s business planning and forecasting process. Issues to address include: ►► Inclusion in business plans of strategic goals and identified risks and opportunities ►► Methodology and robustness of process, including the granularity of forecasts prepared ►► Quantification of principal risks as far as possible to build into the stress test scenarios as an overlay on management’s base forecasts to determine the resilience of the business ►► Production of integrated P&L, balance sheet and cash flow forecasts for use in running various severe but plausible downside scenarios and stress testing. ►► Extent of review and challenge by the board


7

3


Period covered by viability statement Except in rare circumstances, the FRC expects the period for the viability statement to be ‘significantly longer than 12 months from the date of approval of the financial statements’. In a poll conducted during EY’s 2014 Financial Reporting Outlook conference, the majority (55%) of participants (senior finance executives) considered two to five years an appropriate timeframe. Individual circumstances must be considered, however. Boards will need to apply judgement and be clear on the reasons why they have chosen a particular period. Pertinent questions include:

In a poll conducted during EY’s 2014 Financial Reporting Outlook conference, the majority (55%) of participants (senior finance executives) considered two to five years an appropriate timeframe.

►► Can the business cycle in which the company operates be defined? ►► Over what period does management currently forecast as part of the business planning process and capital investment cycle (if relevant)? ►► What period does management consider is a reasonable period on which it should forecast and why? ►► How does the period chosen compare to that selected by other companies in the sector?

Sensitivity and stress tests Although companies typically do conduct sensitivity analysis when considering going concern, they must now consider resilience in ‘severe but plausible’ scenarios. The analysis should now encompass: ►► Sensitivities — the impact on forecasts of combined risks — not just specifically identified risks in isolation — must be considered. ►► Reverse stress testing — flexing forecasts to the extent necessary to ‘bust the business’, then considering mitigating actions. ►► Headroom considerations — after applying sensitivities, how much headroom does the business have in terms of, for example, cash and covenants? Although companies do this already as part of the existing going concern assessment, the 2014 Code requires a severe but plausible assessment (rather than consideration of a ‘worst case’ scenario) over a period significantly longer than 12 months.


8

3


Level of confidence needed by the board The 2014 Code provides limited guidance on the level of confidence required, but it should be seen as a step up from that required for existing going concern practices. Boards will need to apply judgement, and follow a robust process applying an appropriate level of challenge to the key assumptions and drivers underpinning the forecasts reflecting the need to take a severe but plausible downside perspective.

Documentation Documentation should be sufficient to demonstrate that the board has taken the right steps. As a minimum, every board should prepare a paper setting out what it has done, the conclusions it has reached and the rationale for those conclusions. The details of the paper — and the work underpinning it — will be situation and case specific. Where sensitivity analysis has indicated minimal headroom in key metrics, more detail will be needed. These could include flexed forecasts, details of key risks and financial impact. A robust process and adequate documentation will be key for directors to show how they have met their responsibilities.5

5

irectors are covered by the safe harbour provisions of Section 463 of the Companies Act 2006 D where information is included either in the Strategic Report, the Directors’ Report or the Directors’ Remuneration Report (either directly or via a specific cross-reference).


9

4

Conclusion and contacts

The viability statement creates new challenges for boards and their management teams. Internal teams — from risk, internal audit, treasury, finance and others — will need to work together to ensure that systems and processes are adequate. Beginning early in the reporting cycle is highly recommended — not least because of the ongoing nature of the risk and controls monitoring activity now expected of the board. But there are opportunities too. Addressing issues raised by the viability statement could lead to better risk management. For example, it could encourage greater clarity over the risks that companies are willing and able to take on and potentially result in the company being able to take on more risk to generate increased returns. A robust and detailed viability assessment process will also ensure that the business is more resilient to the risks and challenges that it will face in the future.

Companies that embrace the viability statement challenge and look beyond the key compliance requirements stand to achieve the most benefits.

Ultimately, and as noted in the foreword, EY research indicates that companies with more mature, integrated and embedded risk management processes achieve improved financial performance, such as increased EBITDA. Therefore, companies that embrace the viability statement challenge and look beyond the key compliance requirements stand to achieve the most benefits.

Contacts Viability statements, going concern, business resilience, stress testing, financial modelling/forecasting

Bob Ward T: + 44 20 7951 1232 E: [email protected]

Assessing, managing and mitigating risk including risk appetite and internal control effectiveness reviews

Ian Swain T: + 44 121 535 2282 E: [email protected] Patrick Healy T: + 44 20 7951 7026 E: [email protected]

The Corporate Governance Code as a whole

Andrew Hobbs T: + 44 20 7951 5485 E: [email protected] Mala Shah-Coulon T: + 44 20 7951 0355 E: [email protected]

Financial reporting and assurance

Andy Smyth T: + 44 20 7951 3747 E: [email protected]


10

5

Appendix 1

Comparing and contrasting practices today with what will be required to comply with the 2014 Code Risk appetite

In today’s world

What will be needed under the 2014 Code?

►►W ► here disclosure is made it is often high level and lacking in a practical application

►►Determining risk appetite is stated as a board responsibility (The Guidance para 24)

►►Process, where it exists, often lacks structure and substance

►►Ability to articulate what risk appetite means in practice i.e., clear link to strategic planning, business model and decision making

►►Lack of board involvement and hence consensus

►►Regular re-assessment of risk appetite ►►Active board involvement and consensus

Risk assessment

►►Annual top down and bottom up assessment made

►►Principal risks also viewed with solvency and liquidity lens i.e., risks to viability and not just strategy

►►Principal risks seen as primarily risks to strategy and its execution

►►As far as possible, risks quantified in financial terms with clear link to cash flow/P&L impact

►►Risks not quantified by P&L or cash flow

►►Resilience to solvency and liquidity risks assessed with mitigation plan in place

►►Proximity/velocity of risks unclear ►►Not linked to forecasting and planning and hence viability Effectiveness of risk management and internal control systems

►►Annual assessment ►►Unclear control ownership across lines of defence ►►Any control monitoring results not reported to the board ►►Gaps in assurance map ►►Dependent on internal audit plan and execution ►►Disclosure simply states that an effectiveness review was undertaken and necessary actions to mitigate or remedy findings/weaknesses have been or are being taken

The viability statement

►►Going concern assessment and statement — 12 months from date of approval of accounts

►►Board level process needed to ensure ‘ongoing monitoring’ of risk management and internal control systems ►►A complete and comprehensive assurance map — mapping risks and controls against the sources of assurance/comfort ►►Material controls to mitigate principal risks identified ►►More detailed disclosure — including a report summarising the process the board applied in reviewing the effectiveness of the system of risk management and internal control, the actions that have been or are being taken to remedy any significant failings or weaknesses and the extent to which the system accords with the Guidance (para 57–58).

►►Two distinct statements in the ARA — going concern (accounting basis) and viability statement ►►Viability assessment to be done over a significantly longer period than 12 months with clear explanation for choice of period ►►Qualitative and quantitative analysis of risks, measured against risk appetite and fed into the viability statement process ►►Sensitivities and stress testing (in severe but plausible scenarios) ►►Clearly documented process including rationale for conclusions


11

EY | Assurance | Tax | Transactions | Advisory About EY EY is a global leader in assurance, tax, transaction and advisory services. The insights and quality services we deliver help build trust and confidence in the capital markets and in economies the world over. We develop outstanding leaders who team to deliver on our promises to all of our stakeholders. In so doing, we play a critical role in building a better working world for our people, for our clients and for our communities. EY refers to the global organization, and may refer to one or more, of the member firms of Ernst & Young Global Limited, each of which is a separate legal entity. Ernst & Young Global Limited, a UK company limited by guarantee, does not provide services to clients. For more information about our organization, please visit ey.com.

Ernst & Young LLP The UK firm Ernst & Young LLP is a limited liability partnership registered in England and Wales with registered number OC300001 and is a member firm of Ernst & Young Global Limited. Ernst & Young LLP, 1 More London Place, London, SE1 2AF. © 2015 Ernst & Young LLP. Published in the UK. All Rights Reserved. ED None 1593999.indd (UK) 03/15. Artwork by Creative Services Group Design. In line with EY’s commitment to minimise its impact on the environment, this document has been printed on paper with a high recycled content.

Information in this publication is intended to provide only a general outline of the subjects covered. It should neither be regarded as comprehensive nor sufficient for making decisions, nor should it be used in place of professional advice. Ernst & Young LLP accepts no responsibility for any loss arising from any action taken or not taken by anyone using this material.

ey.com/uk

Finding opportunities in the new regulatory challenge

Recommend Documents